Attack Simulator emails bypass mail flow rules

[Fixxser2]

Is there any documentation for Attack Simulator emails bypassing mail flow rules?

We have a mailflow rule that marks and appends a disclaimer to all external emails coming in.  When using the Attack Simulator, emails are bypassed.

[#2 · Accepted solution]

That's by design, the whole idea is to see how the end users react to a bad email, not to test your hygiene configuration.

[#3]

Look in Threat Explorer and you will see that the mails do not even arrive via the conventional delivery pipeline so do not appear there. They are simply written directly from the simulator to each recipient's Inbox. If you want your simulations to display your normal disclaimer for external mail, you will need to include your disclaimer block in the payload.